Changeset 6757 for trunk/src/includes/core/sub-actions.php

Timestamp:

12/20/2017 04:55:13 PM (8 years ago)

Author:

johnjamesjacoby

Message:

Sub-actions: bail on completely invalid/empty get/post requests.

This change ensures that non-empty actions (sanitized via sanitize_key()) will not make their way into the get/post request actions.

This is in addition to similar checks added to AJAX requests in r6755.

File:

• trunk/src/includes/core/sub-actions.php (modified) (2 diffs)

trunk/src/includes/core/sub-actions.php

@@ -354 +354 @@
     $action = sanitize_key( $_POST['action'] );
 
+    // Bail if action was totally invalid
+    if ( empty( $action ) ) {
+        return;
+    }
+
     // This dynamic action is probably the one you want to use. It narrows down
     // the scope of the 'action' without needing to check it in your function.
@@ -381 +386 @@
     // Sanitize the GET action
     $action = sanitize_key( $_GET['action'] );
+
+    // Bail if action was totally invalid
+    if ( empty( $action ) ) {
+        return;
+    }
 
     // This dynamic action is probably the one you want to use. It narrows down